fix: recover npm through trusted release workflow

[regenrek]

Trusted Publishing recovery

Moves the guarded v0.3.3 npm recovery path into .github/workflows/release.yml, the workflow identity authorized for npm Trusted Publishing.

Evidence

Recovery run 30102210946 successfully downloaded and checksum-verified the immutable public release assets, reconstructed provenance, and passed native/launcher validation. npm publish --provenance then returned E404 permission despite a provenance-signed publish attempt. The separate release-npm-recovery.yml workflow is not authorized by the npm Trusted Publishing configuration; release.yml is the established publisher identity.

Safety controls

• recovery is workflow-dispatch-only, hard-limited to v0.3.3, and requires exact publish-v0.3.3 confirmation
• all normal create-release, native build, checksum/release publication, standard npm publish, and Homebrew jobs are explicitly gated to push; dispatch cannot recreate or alter tag/release/tap assets
• recovery checks out immutable v0.3.3, refuses an existing npm version, downloads only public release archives plus SHA256SUMS, verifies every digest, validates exact archive members, reconstructs/validates provenance, and verifies native binary plus npm launcher
• recovery permissions remain contents: read and id-token: write
• removes the unauthorized standalone recovery workflow

Review and validation

Independent reviewer: PASS.

• actionlint
• YAML job-condition inspection
• cargo fmt --all -- --check
• cargo test -p xtask release
• cached diff check

Do not merge or dispatch without direct execution approval.